Difficulties to apply extractors using regex

[gsmith]

@lmattos90

If you want to give something back, I’m very interested In your PowerShell command and the setup you did in your environment. I was wondering if you could demonstrate all this here. Not only for my self but others. Sharing is caring

Miscellaneous

[lmattos90 (Luan De Mattos)]

@gsmith,

For sure my friend, It will be a pleasure to be helpful to others.

# Credentials
$SQLServer = "1.1.1.1\server"
$db = "dummy_data"
$user = "dummyuser"
$pwd ="dummypass"

#Select to get the sql data
  $selectdata = "SELECT TOP 5
       [date_time]
      ,[pc_name]
      ,[user_name]
      ,[file_name]
      ,[operation]
      ,[action]
      ,[source_type]
      ,[destination_type]
      ,[policy_name]
      ,[file_extension]
      ,[file_type]
      ,[file_size]
      ,[source_path]
      ,[destination_path]
      ,[application_name]
      ,[data_categories]
      ,[to_safe_zone]
      ,[is_tagged]
      ,[sensitive_content]
      ,[suspicous]
      ,[id_user]
      ,[id_pc]
      ,[id_application]
      ,[category_extension]
      ,[id_policy]
      ,[policy_bound]
      ,[module]
      ,[policy_restriction]
  FROM [dummy_data].[pbi].[data_security_view] ORDER BY date_time DESC"
 

$dump = Invoke-Sqlcmd -ServerInstance $SQLServer -Username $user -Password $pwd -Database $db -Query $selectdata 

#loop
for ($count=0; $count -lt $dump.Count; $count++)
{

#Format the events per line     
echo "$("pc_name="+$dump[$count].pc_name) $("user_name="+$dump[$count].user_name) $("file_name="+$dump[$count].file_name) $("operation="+$dump[$count].operation)"  >> "C:\Program Files\Management Console\Logs\noencoding_logs.log"
     
#Convert the output file to ascii and output to a file
Get-Content "C:\Program Files\Management Console\Logs\noencoding_logs.log" | Out-File -Encoding ascii "C:\Program Files\Management Console\Logs\sql_logs.log" 
     
}

Isn’t pretty As I already have said, but it works, and this will give me more time to implement something more elegant in the future.

Any doubts just asking.

[gsmith]

And does this also do the text conversion format?

[lmattos90 (Luan De Mattos)]

This line, to be more precise.

#Convert the output file to ascii and output to a file
Get-Content "C:\Program Files\Management Console\Logs\noencoding_logs.log" | Out-File -Encoding ascii "C:\Program Files\Management Console\Logs\sql_logs.log"

[gsmith]

Nice and thank you. I was hoping you write up a post under here so you get credit for it.

If not I can write something up for you. This way in about 20 years this would be easy to access

[lmattos90 (Luan De Mattos)]

That’s cool, my English it’s not that good but I can try, can I write something and send it to you to check if it’s ok? I just want to know how it’s the format, like a mini-tutorial or something?

[gsmith]

Oh course also feel free to DM me if you like. Since this is Friday, I have about 6 more hours here at work then Im playing Video games next two days Actually I have close friends from Switzerland and UK